What is PHI?
PHI is individually identifiable health information in any form or medium, under 45 CFR 160.103. Breach-notice duties apply only to unsecured PHI, so how a fax is protected matters.
Protected health information (PHI) is individually identifiable health information that is transmitted or maintained electronically or in any other form or medium. Under 45 CFR 160.103, a practice's patient records meet that test when they identify the patient and describe the patient's health.
What information does the PHI definition cover?
PHI is individually identifiable health information, which means health information that identifies the person it describes. The definition reaches information kept electronically and information in any other form or medium. Paper charts and faxed pages can carry PHI as well as electronic records, because the definition covers each form.
Which information falls outside the PHI definition?
Information about a person who has been deceased for more than 50 years falls outside the definition. The exclusion sits in paragraph (2)(iv) of the definition in 45 CFR 160.103, and it covers only that group.
Records about a person who died more recently stay within the definition when they identify that person and describe health.
Why does PHI matter for breach notices?
Breach-notice duties apply only to unsecured PHI. Unsecured PHI is PHI that a method HHS specifies has not made unusable, unreadable or indecipherable to unauthorized persons, as 45 CFR 164.402 provides.
Whether faxed PHI counts as secured depends on the method that protects it, and this definition does not settle that question.
How does PHI apply to faxing?
A fax that carries a patient's name and health details is PHI, because the definition reaches any form or medium. Whether its breach-notice duties apply turns on whether that PHI was secured, as the section above explains.
For a fax number alone, see whether a fax number is PHI. For the wider question, see whether faxing is HIPAA compliant.
Which terms get confused with PHI?
Two terms are easy to mix up with PHI.
- Health information that does not identify the person: it falls outside PHI under this definition.
- Unsecured PHI: the part of PHI that breach-notice duties cover, under 45 CFR 164.402.
* Fax Pigeon prices and plan terms as of October 17, 2026.
Frequently asked questions
- What is PHI?
- PHI means protected health information: individually identifiable health information that is transmitted or maintained electronically or in any other form or medium. A practice's patient records meet that test when they identify the patient and describe the patient's health. The definition is in 45 CFR 160.103.
- Which regulation defines PHI?
- 45 CFR 160.103 defines protected health information, and the same section excludes information about a person deceased for more than 50 years. Breach-notice duties are set in 45 CFR 164.402, which limits them to unsecured PHI. Read both sections together, since they use the same term.
- Why does PHI matter for a small practice?
- PHI matters for a small practice because breach-notice duties apply only to unsecured PHI. PHI counts as secured when a method HHS specifies makes it unusable, unreadable or indecipherable to unauthorized persons. Breach duties therefore turn on how the practice's records are protected.
- How does PHI apply to faxing?
- A faxed page that identifies a patient and describes the patient's health is PHI, because the definition covers any form or medium. Whether breach-notice duties apply to that fax depends on whether the PHI was secured. Whether a fax number alone counts as PHI is a separate question.
Fax Pigeon
HIPAA-compliant fax with a signed BAA on every plan
Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.
- Free porting of your local number
- Fax from your email
- AI summary of every inbound fax
- E-signatures
- Contact management
- Delivery proof
Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.